This anecdote makes me very happy with AWS. I want loss of 2FA to completely revoke access to my account. Otherwise any smart hacker can social engineer Amazon support with some fake drivers license photo and steal all my BTC (for example).

So what is your plan in case your phone gets lost/stolen/whatever and you lose access to your TOTP app?

I use Authy as my TOTP client. It has a encrypted backup feature and allows me to share tokens between my devices (computer, phone, iPad, etc.) It's saved me on more than one occasion. :)

Use the backup codes they provided you with when you set up 2FA. Or does Amazon not have those? (If not that seems really strange, every other service I've set up 2FA on has that recovery method.)

They don't provide backup codes.

I have encrypted backups of all my 2FA secrets in two locations. I change phones every year and have never lost an account.

Yeah, that sounds good and all, but what happens if you lose your 2FA then?

This is why, when creating a new 2FA login, you MUST write down the one time use backup codes, and store them in a safe and secure place.

I don't think I've seen any backup codes when enabling 2FA on AWS - do they provide them? Support people haven't mentioned anything about those. If they show them I must have put them somewhere...

I learned this the hard way when google authenticator failed to restore my keys after a phone upgrade. Now I make sure I copy the data from those QR codes and store them in a GPG encrypted file (I store the data and the QR code itself as utf-8 art in the file).

The way that first sentence is phrased makes it sound like it was the app's fault.

I blame the app entirely. Not marking the private keys as something to backup is a really really sucky thing to do.

Most services don't have one-time backup codes, unfortunately.

>Something there in the process is missing like "next of kin" recovery that should be mandatory when enabling 2FAs.

wouldn't this just weaken the second factor? Services that have bypasses to 2FA wind up rendering it useless.

NearlyFreeSpeech seems to have pretty comprehensive account recovery procedures, though I can't say I've ever used them.

https://faq.nearlyfreespeech.net/section/login/losteverythin...

I store my 2FA in 4 different authenticator apps on my phone just in case.

Google Authenticator has never restored these properly, ever. Encrypted backups or not.

I didn't know you can do that, I thought it generates device (app) hashed codes that are synced with first code or some other magic, just today I learned it's just based on this initial code (presented as qr usually) so you can do as you say, just record it in multiple places, great idea, especially that there are even command line tools for it. I'll replicate it on my desktop next time. For now I have to go to notary and send signed docs to amazon, hopefully that'll work to get back access.

You should try Authy. I switched over to it after I got burned by Google Authenticator deleting all my tokens after an upgrade. It can store your tokens in a encrypted central location and allows you to share tokens between devices (computer, phone, tablet, etc.) It kinda freaked me out at first but now I really like it.

It's not supposed to restore them.

Google Authenticator is a bad 2FA app. Authenticator+ costs a couple of bucks but has many features that make it much easier to use, including the ability to back up an encrypted copy of your 2FA keys (standard disclaimers about risk of compromise to this file, yadda yadda yadda). When you change phones, you just download that, decrypt, and pick up where you left off; no hassle trying to replace the 2FA generators, which is a PITA when you have one 2FA, let alone going through that process for several accounts.

If you're going to use Google Authenticator anyway, at least unlock your bootloader before you initialize the identities. You can't get to the key database without being rooted, even if you're doing a full backup with adb, and unlocking/relocking the bootloader wipes the device.

Mobile phone authenticator apps are not that great anyway. They rely on the security of a phone that is connected to the net to keep the keys secure. If someone can get code running on the phone and exploit a privilege escalation vulnerability to get root, they can read the keys. A hardware token like a Yubikey or similar is probably more secure.

Another problem with the Google authenticator, at least for Google accounts, is that you have to add a phone number to your account to use it I think and, they then allow access by SMS, which is not so hard to circumvent.

You can remove the phone number once you add another 2FA method, such as U2F (Security Key) or TOTP (Google Authenticator or other TOTP app).

I like to think "thank god I have a google voice number" but then I realize if google just decides to shaft google voice, as the have to countless of their projects in the past, I am totally fucked in regards to the many things that 2fa off it.

I had this situation. I had an AWS account linked to some email I no longer had access to and could not get into the account. I opened a support ticket and they sent an email to the old address, after 10 days of no response they sent it to "Legal" for review. The account was then closed by them which resolved it for me.

I had 2FA activated, changed phones and lost it. I couldn't log in to my account, so I contacted support. Within about 30 min they had put me back into my account.

The dude who helped me was super chill and understanding as well.

What is the purpose of 2FA when social engineering the support team circumvents it? This should not be possible! Lost your phone? That’s what 2FA backup codes are for.

Whats your proposed resolution for the two cases on this thread?

That if you lose access to all of the 2FA methods you have available, you should just lose access to your account and there be no way to recover it.

If there is a way to recover it, that has to be secured too and, there are only a limited number of ways you can do that (and the more that are enabled, the harder it is to secure). Most services with 2FA offer a set of one-time codes that you can write down and store securely at multiple locations (safes in different places, safe deposit box etc). It is not that hard to avoid losing access if you care. If you don't care enough about the account to do this, just accept losing access, cancel the card payment authorisation and, lose it.

Companies should not grant access to accounts with 2FA by letting you call support unless they at least take proper steps to ensure that you are the account owner, which is pretty impractical in most cases (it is either too costly to be worth it or, too hard to do well enough). Demonstrating that you are the account owner to recover it if you have lost 2FA access should at least require a visit, in person, with photo ID being checked with the relevant authorities (for example the passport service examining your passport to check it is not a forgery) and, multiple people who can attest that you are in fact the person in the photo, to recover an account, for which they would presumably have to charge hundreds of dollars. It seems easier to just not offer recovery in most cases.

Unless you have written backup codes, there should not be a resolution possible. You either remember to changes phone #s before you change them, or you are locked out. Deal with the phone company.

> "There should not be a resolution possible"

This guy works in customer service. LOL

If you're sending me a bill, you need to provide a way for me to resolve an issue such as this. "There is not a resolution possible, we will continue billing you in perpetuity thank you good day" is not acceptable. (It's AWS and they do, so maybe it is, but... try building a new service that isn't AWS with that attitude, and see how far it gets you!)

I kind of see chargeback as a potential resolution for this. If you lost access to your account and can't shut down billing via the normal route, you could still stop payments from your bank or credit card. That is the ultimate source of truth anyway, in regards to payments, so you could "prove" who you are by stopping all continuing payments to the service.

So say I do this, and later my account is sent to collections. Can you think of a worse possible outcome when your phone is dropped in the toilet if you have no scheme for 2FA recovery?

My cloud-hosted business gets shut down, credit score tanks, because of the combination of my butter fingers and your secure authentication scheme! Might as well not employ any CSR drones at all if you're not going to handle this case. Maybe I'm exaggerating, but this is not a great strategy for customer satisfaction or retention.

To the extent that in a dispute situation, who pays the bill =/= whomever holds the keys, my preferred customer service strategy would tend to favor who is paying the bill.

I haven't heard of hosting companies sending anyone to a collection agency. It could happen, sure a but I think it's more likely they just cancel your account and suspend all continued hosting (which, if you believe 2fa should be impossible to circumnavigate, this is probably the ideal outcome). From there you would probably open a new account and start over.

I could see the argument either way on if this is the most optimal solution or not.

>If you're sending me a bill, you need to provide a way for me to resolve an issue such as this.

not if you want it to provide real security.

I dont give a fuck if someone else want to pay my bills

Yeah, for real why does my Comcast account need 2FA?

so you would have no problem posting your username and password for comcast publicly?

Hell no, without 2FA those are the only things protecting my account! Why would I want to post them publicly? That doesn't even make sense.

I do business with 4 banks and have no less than 4 credit cards, and I'm pretty sure that none of them offer proper 2FA with tokens for the online accounts. Now that you mention it, this is a serious question. Why does Comcast get there before any of the major and/or local banks?

I'll admit, if I can protect my Comcast account and as a result, I never have to speak to another one of their Customer Service Reps, it would be a huge victory! This is probably part of their retention strategy, to be fair.

It's telling that there's no mention of on any document, or interface to Comcast's 2FA settings (that I can find anyway) that speaks to how to use it for protecting the set-top box from ordering Pay-Per-View content.

If I turn on 2FA, I'm pretty sure I won't have the option to use it when ordering PPV. It looks like they have a PIN lock instead. Maybe I can disable PPV and protect it with the second factor?

I honestly have no idea why it's even an option. Are swatters gonna log into my Comcast account, upgrade my XFINITY connection to the maximum bandwidth, and sign me up for all of the premium channels?

Or are they hacking my account so they can pay the bill for me :-D

i would have a problem posting them publicly. Now, if someone wants to trick Comcast support so they can pay my bill, go ahead !